T1036.003 Masquerading: Rename Legitimate Utilities

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. MITRE ATT&CK

4 programs on CmdID 21 Sigma rules T1036.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1036Masquerading

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highFile Download Via Bitsadmin To A Suspicious Target FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highFile With Suspicious Extension Downloaded Via BitsadminFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highLOL-Binary Copied From System DirectoryNasreddine Bencherchali (Nextron Systems) · Windows

highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113 · Windows

highPs.exe Renamed SysInternals ToolFlorian Roth (Nextron Systems) · Windows

highRenamed BrowserCore.EXE ExecutionMax Altgelt (Nextron Systems) · Windows

highRenamed Jusched.EXE ExecutionMarkus Neis, Swisscom · Windows

highRenamed Msdt.EXE ExecutionpH-T (Nextron Systems) · Windows

highRenamed Office Binary ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highRenamed ProcDump ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highRenamed Schtasks ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumFile Download Via BitsadminMichael Haag, FPT.EagleEye · Windows

mediumPotential Defense Evasion Via Binary RenameMatthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades) · Windows

mediumSuspicious Copy From or To System DirectoryFlorian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems) · Windows

everyday examples from tldr-pages, CC BY 4.0

To add a file to the job on the page for bitsadmin addfile

bitsadmin /addfile myDownloadJob http://downloadsrv/10mb.zip c:\10mb.zipIdentify

To start a transfer job named myDownloadJob on the page for bitsadmin transfer

bitsadmin /transfer myDownloadJob http://prodserver/audio.wma c:\downloads\audio.wmaIdentify

An example is here when CmdID’s reading of it names T1036.003: a Sigma rule it trips is tagged with it, or its abuse is documented as it.